Learning from the wreckage: Post incident analysis of cyber attacks on critical infrastructure

When a cyber attack hits critical infrastructure, the immediate priority is containment and recovery. But what happens after the dust settles? The most powerful and most overlooked phase of any incident is the post-incident analysis: a structured, honest examination of what happened, how it happened, and what it means for the future.

This session draws on lessons from landmark real-world attacks including the Colonial Pipeline ransomware incident, the Oldsmar water treatment intrusion, Ukraine's power grid disruptions via Industroyer/BlackEnergy, and the Triton/TRISIS malware targeting safety instrumented systems to build a practical framework for post-incident analysis in OT and ICS environments.

Attendees will explore why forensic investigation in operational technology environments is fundamentally more complex than in traditional IT: legacy systems with minimal logging, proprietary protocols, and the operational risk of taking live systems offline to investigate. We will walk through root cause analysis methodologies aligned to NIST SP 800-61 and ICS-CERT guidance, and examine how recurring themes insecure remote access, unpatched systems, IT/OT network convergence, and human error appear again and again across major global incidents.

Critically, this session translates those global lessons into the Australian context. We examine how well local defences in sectors such as energy, water, mining, and transport would hold up against the attack patterns observed overseas, and what security teams should be doing differently right now. We also address the regulatory dimension: what operators of critical infrastructure are required to report and review under Australia's Security of Critical Infrastructure Act 2018 (SOCI Act), and how post-incident obligations intersect with technical investigation.

Whether you are a hands-on incident responder, an OT/ICS engineer, a CISO, or a policy professional, this session will leave you with actionable frameworks, hard won lessons, and a clearer picture of where Australia's critical infrastructure security posture needs to go next.